Privacy

Last updated 24 July 2026

Short, because there isn't much to describe. Everything below is checkable from the bytes we ship.

This website

It sets no cookies, runs no analytics, and makes no third-party requests of any kind. Fonts are served from this domain rather than a font CDN, and a build check fails on any script, stylesheet, image, iframe or preconnect pointing off this domain.

One clarification, since the pricing page cites other companies' pricing pages: those are links, not loads. Nothing is fetched from them unless you click, and because every response carries Referrer-Policy: no-referrer, following one tells them nothing about where you came from. The build check enforces exactly that distinction — it flags anything the browser would fetch on its own, and ignores ordinary links.

There is no contact form, so there is no submission endpoint and no list of addresses on a server. If you email us, we have your email address because you sent it — that is the entire data flow, and you started it.

The documentation pages store two things in your own browser: your light/dark preference, and which sidebar sections you expanded. Neither carries an identifier and neither leaves your machine.

Our host necessarily processes the network request that delivers each page — including your IP address — in order to route it to you. We do not log, store, or analyse it.

The app and the CLI

Zero telemetry. No analytics SDK, and no crash reporter. Not disabled by default — absent from the dependency manifests entirely.

If a crash reporter is ever added it will be opt-in, scrubbed of secret material, and it will show you exactly what is about to be sent before it sends anything.

What our server stores

This is the honest part, and it is the same list that appears in the security docs.

Readable by us:

• Your account email address
• Project and environment names, and their display order
• Payload sizes and version counts
• Who read or wrote which environment, and when
• Public keys — which are public by definition

Not readable by us, ever:

• Every secret value, and every note — ciphertext
• Wrapped environment keys — opaque
• Your private key — encrypted under a key we never see
• Your recovery backup — likewise

Content is opaque. Existence and activity are not. An environment named acme-prod-stripe-live tells us something even though every value inside it is unreadable, so name things with that in mind if it matters to you.

Server-side we keep operational metrics — request counts and latency. Request bodies are never logged, and the codebase's lints deny print statements outright to keep it that way.

What we would disclose

If compelled by valid legal process, what exists to hand over is the readable list above: metadata, and ciphertext we cannot decrypt. We cannot produce plaintext — not as a matter of policy, but because the key that would decrypt it has never been on our infrastructure.

That is the practical difference between "we can't look" and "we won't look".

Getting your data out, and deleting it

cendarum export writes any environment's values to a file you control. Deleting a project deletes its environments, payloads, and grants. Deleting your account removes your keys and memberships.

To delete an account, email hello@cendarum.com from the address on it.

Third parties

The service runs on hosting and managed-database infrastructure, and sends transactional email (recovery codes and invitations) through a mail relay. Those providers process ciphertext and metadata in the course of running the service. None of them can decrypt anything, for the same reason we cannot.

We do not sell, share, or rent anything to anyone, and there are no advertising or analytics partners to share with.

Changes

This page changes when the behaviour changes, in the same release. Cendarum is v0.1.0 and pre-launch; if something here needs to change materially, early-access users will hear it directly rather than by noticing a new date.

Questions: hello@cendarum.com. Security reports: security@cendarum.com.